CVE-2025-4044 - Vulnerability Details - OpenCVE

Improper Restriction of XML External Entity Reference in various Lexmark printer drivers for Windows allows attacker to disclose sensitive information to an arbitrary URL.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Lexmark	Universal Print Driver
Microsoft	Windows

No data.

No data.

References

Link	Providers
https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html

History

Thu, 21 Aug 2025 12:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Lexmark Lexmark universal Print Driver Microsoft Microsoft windows
Vendors & Products		Lexmark Lexmark universal Print Driver Microsoft Microsoft windows

Tue, 19 Aug 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 19 Aug 2025 13:30:00 +0000

Type	Values Removed	Values Added
Description		Improper Restriction of XML External Entity Reference in various Lexmark printer drivers for Windows allows attacker to disclose sensitive information to an arbitrary URL.
Title		XML External Entity Injection vulnerability in various Lexmark Universal Drivers
Weaknesses		CWE-611
References		https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: Lexmark

Published: 2025-08-19T13:12:09.782Z

Updated: 2025-08-20T03:56:03.978Z

Reserved: 2025-04-28T17:54:55.187Z

Link: CVE-2025-4044

Vulnrichment

Updated: 2025-08-19T13:27:17.357Z

NVD

Status : Awaiting Analysis

Published: 2025-08-19T14:15:38.737

Modified: 2025-08-20T14:40:17.713

Link: CVE-2025-4044

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-4044", "assignerOrgId": "7bc73191-a2b6-4c63-9918-753964601853", "state": "PUBLISHED", "assignerShortName": "Lexmark", "dateReserved": "2025-04-28T17:54:55.187Z", "datePublished": "2025-08-19T13:12:09.782Z", "dateUpdated": "2025-08-20T03:56:03.978Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "Universal Print Driver", "vendor": "Lexmark", "versions": [{"lessThan": "3.0.6.0", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "Printer Software G2", "vendor": "Lexmark", "versions": [{"lessThan": "2.17.0.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "datePublic": "2025-08-18T16:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Restriction of XML External Entity Reference in various Lexmark printer drivers for Windows allows attacker to disclose sensitive information to an arbitrary URL.<br>"}], "value": "Improper Restriction of XML External Entity Reference in various Lexmark printer drivers for Windows allows attacker to disclose sensitive information to an arbitrary URL."}], "impacts": [{"capecId": "CAPEC-221", "descriptions": [{"lang": "en", "value": "CAPEC-221 Data Serialization External Entities Blowup"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-611", "description": "CWE-611 Improper Restriction of XML External Entity Reference", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7bc73191-a2b6-4c63-9918-753964601853", "shortName": "Lexmark", "dateUpdated": "2025-08-19T13:12:09.782Z"}, "references": [{"url": "https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html"}], "source": {"discovery": "UNKNOWN"}, "title": "XML External Entity Injection vulnerability in various Lexmark Universal Drivers", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-19T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2025-4044"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-20T03:56:03.978Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-4044", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-08-19T13:27:15.347309Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-19T13:27:17.357Z"}}], "cna": {"title": "XML External Entity Injection vulnerability in various Lexmark Universal Drivers", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-221", "descriptions": [{"lang": "en", "value": "CAPEC-221 Data Serialization External Entities Blowup"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Lexmark", "product": "Universal Print Driver", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.6.0", "versionType": "custom"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}, {"vendor": "Lexmark", "product": "Printer Software G2", "versions": [{"status": "affected", "version": "0", "lessThan": "2.17.0.0", "versionType": "custom"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "datePublic": "2025-08-18T16:00:00.000Z", "references": [{"url": "https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Restriction of XML External Entity Reference in various Lexmark printer drivers for Windows allows attacker to disclose sensitive information to an arbitrary URL.", "supportingMedia": [{"type": "text/html", "value": "Improper Restriction of XML External Entity Reference in various Lexmark printer drivers for Windows allows attacker to disclose sensitive information to an arbitrary URL.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-611", "description": "CWE-611 Improper Restriction of XML External Entity Reference"}]}], "providerMetadata": {"orgId": "7bc73191-a2b6-4c63-9918-753964601853", "shortName": "Lexmark", "dateUpdated": "2025-08-19T13:12:09.782Z"}}}, "cveMetadata": {"cveId": "CVE-2025-4044", "state": "PUBLISHED", "dateUpdated": "2025-08-20T03:56:03.978Z", "dateReserved": "2025-04-28T17:54:55.187Z", "assignerOrgId": "7bc73191-a2b6-4c63-9918-753964601853", "datePublished": "2025-08-19T13:12:09.782Z", "assignerShortName": "Lexmark"}, "dataVersion": "5.1"}